guardrailsio / awesome-golang-security Goto Github PK

Hi, someone linked guardrailsio/awesome-golang-security to gophers slack #security. As I typically do when I hear of a new "security thing", I'm briefly assessing its threat model.

A couple threats I've considered here:

• this repo could contain intentionally poisoned links
• a linked project could be clean today but intentionally poison a future release.

(Again I'm just imagining possible threats; I don't have reason to believe those or other attacks are happening; I'm not accusing the contributors or linked projects.)

I would have dropped it at this point, but these bits piqued my interest:

Supported by: [GuardRails.io](https://www.guardrails.io)

[GuardRails](https://www.guardrails.io) - A GitHub App that gives you instant security feedback in your Pull Requests.

Send me a pull request...

say _hi_ on [Twitter](https://twitter.com/pxlpnk)

@pxlpnk's linked github and twitter don't mention guardrails.io.
Does guardrails.io now maintain this repo?
Is there any "support" provided by guardrails.io beyond maintaining the repo?
If not, consider updating the copy:

- Supported by: GuardRails.io
+ Maintained by: GuardRails.io
- Send me a pull request...
+ Submit a pull request...
- say _hi_ on [Twitter](https://twitter.com/pxlpnk)

Hi,
Some suggestions for the curated list:

For the Web Framework Hardening:

• beego-security-headers - beego framework filter for easy security headers management.

For the Articles, Guides & Talks:

• ReDoS in Go by Checkmarx - Diving Deep into Regular Expression Denial of Service (ReDoS) in Go

Thanks for the great list.

For instance, you could add Consul to the PKI part.

Imo it would be a good idea to add this list to the already existing awesomelist (https://github.com/sindresorhus/awesome you also listed) to not fragment the information.